Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
Storm-3119 (YAM Store) acts as a power broker selling compromised Microsoft 365 and Google infrastructure to Storm-2990, who develops and operates global Phishing-as-a-Service (PaaS) kits.
A Chinese-speaking threat actor utilizes the ARTEX framework combined with multiple AI models to automate global reconnaissance and data exfiltration targeting PII and financial records.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.
Silent Ransom Group (Luna Moth) is conducting high-value data extortion campaigns against US law firms using a combination of vishing and physical office intrusions to exfiltrate sensitive data.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
Luna Moth (Silent Ransom Group) uses voice-based callback phishing to trick victims into installing legitimate RMM tools for data extortion without using encryption.
A coordinated campaign of 16 malicious Firefox extensions masquerades as Rabby and OKX wallets to intercept and exfiltrate recovery phrases and private keys.
